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IN THE CLAIMS: 
Amended claims follow: 

1 . (currently amended) A method performed by a provider of a computer file to 
trigger updating of said computer file used by a computer in a database of computers, 
said method comprising the steps of: 

(i) providing an updated version of said computer file at a location from 
which it may be downloaded by said computer; 

(ii) sending a tag indicative of availability of said updated computer file to 
said database of computers utilizing email addresses associated with computers in sai4 
database such that said tag is sent to said c omputers in said database utilizing said email 
addresses; and 

(iii) maintaining said database of computers to which said tag is to be sent 
when an updated version of said computer file is made available, wherein said database 
of computers includes priority data indicating a priority level associated with an address 3 
said priority level being used to control how rapidly after said updated version of said 
computer file is made available said tag is sent to said database of computers, said 
priority level controlling selection of one of a plurality of different finite delay periods 
after said updated version of said computer file is made available following which said 
tag is sent to said database of computers; 

wherein said tag includes data indicative of a version level of said computer file a 
data indicative of a version level of a software program as sociated with said computer 
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file. and data indicative of a version level of an engine associated with said software 

program: 

wherein said tap is encrypted: 

wherein said tag is part of an e-mail message header; 

wherein sending said tag to said database of computers further comprises: 

transmitting said tag through at least one local server and at least one mail 
gateway connected to said computers in said database such that s aid at least one 
local server reads said tag to determine if said data indicati ve of said version level 
of said computer file is more recent than a second version level of a computer file 
located on said at least one local server, and further such that said at least one 
mail gateway reads said tag to determine if said data indicative of said version 
level of said computer file is more recent than a third version level of a computer 
file located on said at least one mail gateway; 

if said tag includes data indicative of a more recent version level than said 
second version level of said computer file located on said at least one local server, 
said at least one local server initiating a download of said computer file associated 
with said tag: and 

if said tag includes data indicative of a more recent version l evel than said 
third version level of said computer file located on said at least one mail gateway, 
said at least one mail gateway initiating a download of said computer file 
associated with said tag . 

2. (cancelled) 
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3. (cancelled) 

4. (original) A method as claimed in claim 1, wherein said computer is connected 
to said location via an internet link. 

5. (original) A method as claimed in claim 1, wherein computer file is computer 
virus definition data. 

6. (original) A method as claimed in claim 1, wherein said computer file is an 
anti-virus computer program file. 

7. (cancelled) 

8. (cancelled) 

9. (cancelled) 

10. (original) A method as claimed in claim 1, wherein sending of said tag upon 
availability of an updated version of said computer file is provided as a subscription 
service by said provider. 
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11. (currently amended) A computer program product recorded on a computer 
readable medium for use by a provider of a computer file to trigger updating of said 
computer file used by a computer said provider having provided an updated version of 
said computer file at a location from which it may be downloaded by said computer, said 
computer program product comprising; 

(i) tag sending code operable to send a tag indicative of availability of said 
updated computer file to said compute r utilizing an email address a ssociated with said 
computer such that said tag is sent to said computer utilizing said email address : and 

(ii) database code operable to maintain a database of computers to which said 
tag is to be sent when an updated version of said computer file is made available, wherein 
said database includes priority data indicating a priority level associated with an address, 
said priority level being used to control how rapidly after said updated version of said 
computer file is made available said tag is sent to said computer, said priority level 
controlling selection of one of a plurality of different finite delay periods after said 
updated version of said computer file is made available following which said tag is sent 
to said database of computers; 

wherein said tag includes data indicative of a version level of said computer file a 
data indicative of a version level of a software program associated with said computer 
file, and data indicative of a version level of an engine associated with said software 
program : 

wherein said tag is encrypted: 

wherein said tag is part of an e-mail message header; 

wherein sending said tag to said computer further comprises: 
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transmitting said tag through a local server and a mail gatewa y connected 
to said computer such that said at least one local server reads said tag to determine 
if said data indicative of said version level of said computer fil e is more recent 
than a second version level of a computer file located on said at le ast one local 
server, and further such that said at least one mail gate way reads said tag to 
determine if said d ata indicative of said version level of said computer file is more 
recent than a third version level of a computer fde loc ated on said at least one 
mail gateway; 

if said tag includes data indicative of a more recent version level than said 
second version level of said computer file located on said local server said local 
server initiating a download of said computer file ass ociated with said tag; and 

if said tag includes data indicative of a more recent ve rsion level than said 
third version level of said computer file located on said mail gatewa y, said mail 
gateway initiating a download of said computer file associated with said tag, 

12. (cancelled) 

13. (cancelled) 

14. (original) A computer program product as claimed in claim 11, wherein said 
computer is connected to said location via an internet link. 
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15. (original) A computer program product as claimed in claim 11, wherein 
computer file is computer vims definition data. 

1 6. (original) A computer program product as claimed in claim 1 1 7 wherein said 
computer file is an anti-virus computer program file. 

17. (cancelled) 

18. (cancelled) 

19. (cancelled) 

20. (original) A computer program product as claimed in claim 11, wherein 
sending of said tag upon availability of an updated version of said computer file is 
provided as a subscription service by said provider. 

21. (currently amended) Apparatus for use by a provider of a computer file to 
trigger updating of said computer file used by a computer said provider having provided 
an updated version of said computer file at a location from which it may be downloaded 
by said computer, said apparatus comprising: 

(i) a tag sender operable to send a tag indicative of availability of said 
updated computer file to said r^mputer utilizing an em ail address associated with said 
computer such that said tag is sent to said computer util izing said email address; and 
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(ii) database logic operable to maintain a database of computers to which said 
tag is to be sent when an updated version of said computer file is made available, wherein 
said database includes priority data indicating a priority level associated with an address, 
said priority level being used to control how rapidly after said updated version of said 
computer file is made available said tag is sent to said computer, said priority level 
controlling selection of one of a plurality of different finite delay periods after said 
updated version of said computer file is made available following which said tag is sent 
to said database of computers; 

wherein said tag includes data indicative of a version level of said computer file 4 
data indicative of a version level of a software program associated with said c omputer 
file, and data indicative of a version level of an engine associated with sa id software 
program: 

wherein said tag is encrypted: 

wherein said tag is part of an e-mail message header; 

wherein sending said tag to said computer further comprises: 

transmitting said tag through a local server and a mail gateway connected 
to said computer such that said at least one local server reads said tag to determine 
if said data indicative of said version level of said computer file is more recent 
than a second version level of a computer file located on said at least one local 
server, and further such that said at least one mail gateway reads said tag to 
determine if said data indicative of said version level of said computer file is more 
recent than a third version level of a computer file located on said at least one 
mail gateway; 
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jf said tag includes data indicative of a more recent version le vel than said 
second version level of said computer file located on said local server, said local 
server initiating: a download of said computer file asso ciated with said tag: and 

if said tag includes data indicative of a more recent ver sion level than said 
third version level of said computer file located on said ma il gateway, said mail 
gateway initiating a download of said computer file asso ciated with said tag. 

22. (cancelled) 

23. (cancelled) 

24. (original) Apparatus as claimed in claim 21, wherein said computer is 
connected to said location via an internet link. 

25. (original) Apparatus as claimed in claim 21 , wherein computer file is 
computer virus definition data. 

26. (original) Apparatus as claimed in claim 21, wherein said computer file is an 
anti-virus computer program file. 

27. (cancelled) 

28. (cancelled) 
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29. (cancelled) 

30. (original) Apparatus as claimed in claim 21, wherein sending of said tag upon 
availability of an updated version of said computer file is provided as a subscription 
service by said provider. 

3 1 . (new) A method as claimed in claim 1, wherein said tag further includes 
parameter data indicating options previously applied to said e-mail message. 

32. (new) A method as claimed in claim 31, wherein said parameter data indicates 
scan options previously applied to said e-mail message including at least one of scan all 
files, scan utilizing macro heuristics, and scan utilizing all heuristics. 

33. (new) A method as claimed in claim 1, wherein each computer that receives 
said tag determines whether said data indicative of said version level of said computer 
file is more recent than said version level of a computer file located on said each 
computer, such that if said data indicative of said version level of said computer file is 
more recent, said each computer that receives said tag further determines whether said 
data indicative of said version level of said computer file is larger than a threshold 
number of versions ahead of said version level of said computer file located on said each 
computer, and if said threshold is met, said message is identified as possibly malicious 
and said e-mail message is scanned by said each computer. 
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